> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

Adventure: skyticket bus booking pages viewable without login

skyticket bus booking confirmation pages could be shown without logging in, and a third party viewed them automatically from 3 August to 1 October. Names (kana), ages, gender, email addresses, phone numbers, trip details and companion names of about 12,000 bookings were or may have been viewed. The pages were fixed on 1 October.

Disclosed

2026-10-09

Organizations involved

1

Leaked or at risk

12K

12,000

Downtime

Unknown

Timeline

  1. Started 2026-08-03
  2. Detected, Resolved 2026-10-01
  3. Disclosed 2026-10-09
  4. 67 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Gender][Date of birth][E-mail address][Phone number][Purchase history]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][Official]不正アクセスによるお客様情報の流出に関するお詫びとお知らせAdventure · 2026-10-09